Check Point confirms gateway exploitation with implants and wiper

The latest alert says attackers chained PHP2Shell with CVE-2026-123039 to obtain root access on Check Point gateways and install persistent implants. One investigated chain reportedly reached a VMware ESXi host and deployed a destructive wiper. These are claims summarized by third-party posts, not independently demonstrated by the evidence provided here.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The reported chain began through Mobile Access portals on unpatched Check Point Security Gateways, using PHP2Shell for entry and CVE-2026-123039 through DynamicCLI for privilege escalation. The operators allegedly added PHP webshells, the TSGA backdoor and its TSProxy networking component before, in at least one investigation, moving over SSH to ESXi infrastructure and running the destroy_v6 wiper.[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

If the reported chain is accurate, an exposed edge gateway can become a route into more sensitive infrastructure. The claimed move from a gateway to an ESXi host is especially serious because disruption at the virtualization layer can affect multiple workloads rather than a single machine.[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

The latest alert advises applying the appropriate branch-specific Jumbo Hotfix and investigating exposed systems. Defenders should prioritize internet-facing gateways that were unpatched during the reported activity window and look for the described webshells, persistence components and signs of movement toward ESXi hosts.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The supplied posts consistently describe gateway exploitation, persistent implants and one destructive ESXi chain. What remains unresolved is who controlled the operation, whether the same operator conducted every stage, how many organizations were compromised and whether destructive activity occurred beyond the reported Israeli-focused wave.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

DailyDarkWeb summarized the case as a confirmed chain from PHP2Shell and CVE-2026-123039 to root access, persistence and an ESXi wiper. A Reddit submission supplied a broader narrative involving two waves, PhiliKit-related tooling and uncertain attribution, but the included AutoModerator comment added no incident evidence.[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list[3]AutoModeratorreddit.com · AutoModerator · r/pwnhub · redditOpen original sourceSee in source list

According to the Reddit account, exploitation began on October 30, 2026 with a wave focused on Israeli organizations and destructive activity. A second wave allegedly followed on November 2 across several countries and sectors, without observed destructive activity in those cases. The later DailyDarkWeb post condensed the story around the exploit chain, persistence and remediation.[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

2 independent groups, 2 updates, and 0 engagements. Observed communities: r/pwnhub.

The technical account describes PHP2Shell as the initial-access method and CVE-2026-123039 in DynamicCLI as the privilege-escalation step. It names PHP webshells, TSGA and the embedded TSProxy component as persistence or access tools, followed by SSH movement to VMware ESXi and execution of destroy_v6 in the destructive chain.[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list

The batch contains a Check Point Research feed entry linking to the relevant research page, but it includes no article body. The substantive details come from a DailyDarkWeb post and a Reddit submission that point back to Check Point. They support reporting what was claimed, but do not provide raw telemetry, indicators, affected-version tables or direct technical artifacts for independent verification.[4]research.checkpoint.comresearch.checkpoint.com · rssOpen original sourceSee in source list[1]DailyDarkWebx.com · DailyDarkWeb · xOpen original sourceSee in source list[2]Check Point Gateways Hit by PHP2Shell Exploits and Destructive Wiperreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list